Infinite Loop Vulnerability in Apache PDFBox (CVE-2021-31812)
Summary
CVE-2021-31812: In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. Affects libpdfbox-java versions 1:1.8.16-2 – 1:1.8.16-5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache PDFBox is an open-source Java library that allows users to create, manipulate, and extract content from PDF documents. It is widely used in applications that require PDF generation and processing. The library provides functionalities such as text extraction, PDF creation, and manipulation of PDF documents. However, certain versions of PDFBox are vulnerable to a specific issue that can lead to an infinite loop when loading specially crafted PDF files.
Vulnerability Detail
The vulnerability identified as CVE-2021-31812 arises from a flaw in the way Apache PDFBox handles certain PDF files. When a carefully crafted PDF file is loaded, it can trigger an infinite loop, causing the application to hang indefinitely. This issue affects Apache PDFBox versions 2.0.23 and earlier, and it can lead to denial of service, as the application becomes unresponsive. The root cause of this vulnerability is related to the parsing logic within the library, which fails to handle specific edge cases in the PDF structure.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate upgrading is not feasible, users can implement a workaround by validating PDF files before processing them with PDFBox. This can be done by using a separate validation tool to check for potential issues in the PDF structure that may lead to infinite loops.
Conclusion
The infinite loop vulnerability in Apache PDFBox (CVE-2021-31812) poses a significant risk to applications that rely on this library for PDF processing. Users are strongly advised to upgrade to version 2.0.24 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for open-source vulnerabilities in real-time.
See every vulnerability recorded for libpdfbox-java →
FAQ
CVE-2021-31812 is a vulnerability in Apache PDFBox that can cause an infinite loop when loading specially crafted PDF files.
Apache PDFBox versions 2.0.23 and earlier are affected by this vulnerability.
Exploiting this vulnerability can lead to denial of service, as the application may become unresponsive.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2021-31812 is 5.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for libpdfbox-java.
